[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)

From: <bugzilla-noreply_at_freebsd.org>
Date: Thu, 19 Sep 2024 13:04:55 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701

--- Comment #93 from commit-hook@FreeBSD.org ---
A commit in branch releng/13.3 references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=7dabb892096e4e3ba7526914b94f97218d9690d3

commit 7dabb892096e4e3ba7526914b94f97218d9690d3
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-08-26 12:59:38 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2024-09-19 13:00:57 +0000

    pf: improve the ICMPv6 direction check

    Following bluhm's advice this changes the way we setup state keys and
    perform state lookups for ICMPv6 Neighbor Discovery packets:
      - replace the NS-dst with ND target address;
      - replace the NA-src with ND target address;
      - replace the NA-dst with unspecified address if it is a multicast.

    This allows pf to match Address Resolution, Neighbor Unreachability
    Detection and Duplicate Address Detection packets to the corresponding
    states without the need to create new ones or match unrelated ones.
    As a side effect we're doing now one state table lookup for ND packets
    instead of two.

    Fixes a bug uncovered by one of the previous commits that virtually
    breaks IPv6 connectivity after few minutes of use.

    ok stsp henning, with and ok bluhm

    Approved by:    so
    Security:       FreeBSD-EN-24:16.pf
    PR:             280701
    MFC after:      1 week
    Obtained from:  OpenBSD, mikeb <mikeb@openbsd.org>, 2633ae8c4c8a
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

    (cherry picked from commit 5ab1e5f7e5585558a73b723f07528977a82cee82)
    (cherry picked from commit b84344206721ed2803d5da68585289d5880efe3f)

 sys/net/pfvar.h        |   2 +-
 sys/netpfil/pf/pf.c    | 116 ++++++++++++++++++++++++++++++++++---------------
 sys/netpfil/pf/pf_lb.c |   2 +-
 3 files changed, 84 insertions(+), 36 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.